Chan, Elvis M. (SF) (FBI) 


From: Chan, Elvis M. (SF) (FBI) 

Sent: Friday, September 30, 2016 9:50 AM 

To: Rich, Patricia R. (SF) (FBI); Hammell, Delynn B. (SF) (FBI); Kick, Jason B. (SF) (CON); 
Nam, Hye M. (SF) 

Subject: Fwd: Follow Up 


FYI. Request sent. 


Regards, 
Elvis 


Elvis M. Chan 

Supervisory Special Agent 
Squad CY-1 

San Francisco Division 

Federal Bureau of Investigation 
Work: 415-553-7605 

Cell: EDEN -6196 


E-mail: elvis.chan@ic.fbi.gov 


-------- Original message -------- 

From: "Hawkins, E. A. (WF) (FBI)" <Adrian.Hawkins@ic.fbi.gov> 

Date: 09/30/2016 6:10 AM (GMT-08:00) 

To: "Sussmann, Michael A. (Perkins Coie)" <MSussmann@perkinscoie.com>, "Newel , Sean (NSD) (JMD)" 
<Sean.Newell@usdoj.gov> 

Cc: "Lai, Sarah (NSD) (JMD)" <Sarah.Lai3@usdoj.gov>, "Shih, Jeffrey (USACAN)" <Jeffrey.Shih@usdoj.gov>, 
"Chan, Elvis M. (SF) (FBI)" <Elvis.Chan@ic.fbi.gov>, "Milligan, Julissa L. (Perkins Coie)" 
<JMilligan@perkinscoie.com>, "Garrett, Lafayette M. (WF) (FBI)" <Lafayette.Garrett@ic.fbi.gov> 

Subject: Re: Follow Up 


?Good morning, 


I've attached an additional! list on behalf of the San Francisco Division: 


DNC 


Priority Requests 
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1. Un-redacted copies of Crowdstrike reports related to DNC incidents. 
2. Logical/Physical Network Diagrams of DNC Networks 
3. Any data logging the ingress and egress of data to/from the DNC networks, to include, but not limited to: 


-Firewall Logs 

-IDS/IPS or security device logs 
-Netflow Logs 

-PCAP data 

-DNS Query Logs 

-SMTP Logs 

-Web Proxy Logs 

-VPN Logs 

-Network Device Logs 


Secondary Requests 


1. Disk/System Images for all compromised hosts, as listed on pages 67-68 of the DNC Incident Investigation 
Report 


2. Memory Images for al! compromised hosts, as listed on pages 67-68 of the DNC Incident Investigation 
Report 


DCCC 

Priority Requests 

1. Un-redacted copies of Crowdstrike reports related to DCCC incidents. 
2. Logical/Physical Network Diagrams of DCCC Networks 

3. Any data logging the ingress and egress of data to/from DCCC networks, to include, but not limited to: 
-Firewall Logs 

-IDS/IPS or security device logs 

-Netflow Logs 

-PCAP data 

-DNS Query Logs 

-SMTP Logs 

-Web Proxy Logs 

-VPN Logs 

-Network Device Logs 

Secondary Requests 


1. Disk/System Images for all compromised hosts, as listed on pages 53-54 of the DCCC Incident 
Investigation Report 
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2. Memory Images for al! compromised hosts, as listed on pages 53-54 of the DCCC Incident Investigation 
Report 


? 


E. Adrian Hawkins 
Special Agent 
Washington Field Office 


REDACTED OS 74 


From: Sussmann, Michael A. (Perkins Coie) <MSussmann@perkinscoie.com> 

Sent: Tuesday, September 27, 2016 10:34 PM 

To: Newell, Sean (NSD) (JMD) 

Cc: Lai, Sarah (NSD) (JMD); Shih, Jeffrey (USACAN); Chan, Elvis M. (SF) (FBI); Hawkins, E. A. (WF) (FBI); Milligan, 
Julissa L. (Perkins Coie) 

Subject: Re: Follow Up 


Sean, 


We'll begin reviewing your request and get back to you shortly. I have added Julissa to the cc line, as she 
will be supporting. 


Regards, 


Michael 


Michael Sussmann Perkins Coie LLP 
P: 202.654.6333 
WWW. inscoie.com/msussmann 


From: "Newell, Sean (NSD)" <Sean.Newell@usdoj.gov> 

Date: Tuesday, September 27, 2016 at 6:14 PM 

To: Michael <msussmann @perkinscoie.com> 

Cc: "Lai, Sarah (NSD)" <Sarah.Lai3@usdoj.gov>, "Shih, Jeffrey (USACAN)" <Jeffrey.Shih@usdoj.gov>, "Chan, Elvis M. 
(SF) (FBI)" <Elvis.Chan@ic.fbi.gov>, "Hawkins, E. A. (WF) (FBI)" <Adrian.Hawkins@ic.fbi.gov> 

Subject: Follow Up 


Michael, 


As discussed yesterday, | am writing to request an initial batch of items from your clients. For all victims, DOJ and FBI 
request the following: 


1. Any released files that are believed to be fake or modified and, if applicable, the original, unmodified file; and 

2. 24-36 released files that were not circulated outside each of victim organizations (e.g., the donor list that was 
mentioned during our meeting) and a preliminary indication as to whether any of these may have been 
modified. 


For DCCC only, we request access to data and/or employees that could speak to the two screenshots at the bottom 
of this e-mail as having been created from an amalgamation of files or directories on the DCCC network. We believe 
that DCCC and/or Crowdstrike may have looked into these screenshots between on or about September 2 and 6, 
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2016. 


Finally, as Sarah mentioned during the meeting, some media reporting referred to an ongoing DNC effort to review 
documents to see if any had been “forged.” To close the loop on that, we pulled up the following from a USA Today 
article regarding the September 13, 2016 information release: “In response to that most recent leak, DNC interim 
chair Donna Brazile stated that their “legal team is now in the process of reviewing these private documents, and 
attempting to confirm their authenticity, as it is common for Russian hackers to forge documents.”” 


We'll provide the more comprehensive wish list by the end of the week. 
Thank you. 

Sean Newell 

Deputy Chief — Cyber 

Counterintelligence and Export Control Section 

National Security Division 


U.S. Department of Justice 
(202) 532-4585 


Screenshot 1 


SCC_0002560 


No. 1:21-cr-00582-CRC (D.D.C.) DX-147_0004 


2015 Events 
2015 Holiday Lists 
2016 Events 
All Letter 
+ CA Researach 
A Candidate Giving and Raising 
_ Candidate MOC Events 
Check Requests 
_ Condolence Spreadsheet 
Contracts & Agreements 
COS Call Time & Engagement 
Deployment 
DM Money Raised 
Endorsements 
Events Calendar 
Exit Memo 
FEC Filings 
. Finance Plan 
Labor 
=> Money In 
NP City Tracker 
a NP event tracker 
> NPVE 
PAC Invoices 
- Phone Banks 
. Press 
` Primary Call Sheets 
Problem Checks 
__ Reimbursement Forms 
Schedule Requests 
Target Lists 
Team Pelosi 
Thank Yous 
Visa 
Weekly NP Cobalt Email 
2015 NP4C disbursements $200 and upt... 
P 2015 PTF Disbursements to update mont... 
~ 2015-2016 Contribution Limits (DCCC) 
2016 EMAIL BLAST LIST 317.16 
Copy of 2016 Cycle Primary Dates - 3 21... 
Dem Presidential Caucus Results by CD 


Screenshot 2 
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Pelosi Call Sheets 
Pelosi Vote Email 
1713 Pelosi DCCC renewal fundraising letter Q1 
— 022014 DCCC Lunch - Hon John Lewis Leader Pelosi in Atlanta 
2.11.15 BRL Costa Aguilar Pelosi FL Floor Cards 
61213 Pelosi Freshmen Member Dinner Invite 
61413 Team Pelosi Scheduling Request 
~ 619 13 Pelosi Women's Dinner Invite 
08 25 13 Austin - Reception with Leader Pelosi 
83111 Pelosi Email Invite with elected officals 
~ 83111 Pelosi Printed Invite-final with EDITS 
815.15 Pelosi Napa Dinner - Auberge de Soleil RSVPs 
09 2313 Tampa - Reception with Leader Pelosi DRAFT 
_ 09 24 13 San Juan - Reception with Leader Pelosi_DRAFT 
~ 91313 Invite Larson Pelosi 
2012 NP Briefing Napa Pelosi Cocktails 8-1-12 
2012 NP Briefing Napa Pelosi Cocktails 8-5-12 
Addendum to Leader Nancy pelosi for Pascua Yaqui Official meeting 
 BEO's Suite 31 El Pelosi Box 
Breakfast with Democratic Leader Pelosi Invitation ~ February 5 2013 
_ Breakfast with Leader Pelosi Invitation ~ June 27 
Brunch with Democratic Leader Pelosi ~ June 9 2013 
Caplan, Connie Pelosi 10.14.12 
_ check request.Photegraphy of Speaker Pelosi at the Scheinmans.KJ 
check request. WomenLEAD Event video of Leader Pelosi for DC Lu... 
_ Cohen Suzanne Pelosi 1011 12 
Copy of 8.23.13 JFT Pelosi event BOS 
. Copy of Copy of PELOSI HOLIDAY CARD DCCC LIST - Updated 2015... 
Cowan, Cam Pelosi 10.14.12 
Friedman Howard Pelosi 10 14 12 (2) 
Friedman, Howard Pelosi10.14.12 
FW Nancy Pelosi Victory Fund Customer Receipt Purchase Confirm... 
Goldberg Hank Pelosi 10 11 12 
— Greeneboum Stewart Pelosi 10 12 12 
Horn Pelosi Calls 2014 
items for pelosi meeting 
 Kazor Lisa Pelosi10 1212 
Krieger Betsy Pelosi 10 1212 
Leader Pelosi Intro Tp's for VDay Dinner 
memorandum to Leader Nancy Pelosi 
— Moodispaw Len Pelosi 1012 12 
Morgan Linda Pelosi 10 11 12 
Pelosi 100 Renewal 
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